CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause an application crash.
The Hipchat Integration Plugin for Bitbucket Server and the HipChat plugins for Confluence and JIRA before specified versions allow remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.
CSRF vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) versions 2.0.7, 1.5.10 and earlier allows remote attackers to hijack user authentication for requests that execute arbitrary Groovy code.
tcprewrite in tcpreplay before version 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) by sending a large frame.
Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse using msi.dll, dpapi.dll, or cryptui.dll located in the current working directory.
Ruby-saml before version 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response and supplying a crafted update.
Extbase in TYPO3 versions 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
The impersonate feature in Gitlab versions 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to 'log in' as any other user via unspecified vectors.
The MySQL user parameter configuration script in the Zabbix agent before version 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows attackers to execute arbitrary code or SQL commands via the mysql.size parameter.
The vulnerability in Snort 2.9.7.0-WIN32 related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a malicious tcapi.dll file located in the same folder as a processed pcap file.
CVE-2016-1281 describes an untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, and VeraCrypt before version 1.17-BETA, allowing local users to execute arbitrary code with administrator privileges. This can lead to DLL hijacking attacks using a Trojan horse DLL in the application directory.
The eShop plugin version 6.3.14 for WordPress contains multiple SQL injection vulnerabilities in eshop-orders.php, allowing remote administrators and authenticated users to execute arbitrary SQL commands.
Terminology version 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and are then written to the terminal.
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a 'regular expression denial of service (ReDoS).'
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, known as a 'regular expression denial of service (ReDoS).
The marked package before version 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a 'catastrophic backtracking issue for the em inline rule,' also known as a 'regular expression denial of service (ReDoS).'